Add NewProxyAutoTLSTransport and DialTLSWithBackOff to support TLS proxy

network/h2c.go

@@ -54,3 +54,16 @@ func newH2CTransport(disableCompression bool) http.RoundTripper {
 		},
 	}
 }
+
+// newH2Transport constructs a neew H2 transport. That transport will handles HTTPS traffic
+// with TLS config.
+func newH2Transport(disableCompression bool, tlsConf *tls.Config) http.RoundTripper {
+	return &http2.Transport{
+		DisableCompression: disableCompression,
+		DialTLS: func(netw, addr string, tlsConf *tls.Config) (net.Conn, error) {
+			return DialTLSWithBackOff(context.Background(),
+				netw, addr, tlsConf)
+		},
+		TLSClientConfig: tlsConf,
+	}
+}

network/transports.go

@@ -18,6 +18,7 @@ package network
 
 import (
 	"context"
+	"crypto/tls"
 	"errors"
 	"fmt"
 	"net"
@@ -45,7 +46,7 @@ func newAutoTransport(v1, v2 http.RoundTripper) http.RoundTripper {
 	})
 }
 
-const sleepTO = 30 * time.Millisecond
+const sleep = 30 * time.Millisecond
 
 var backOffTemplate = wait.Backoff{
 	Duration: 50 * time.Millisecond,
@@ -63,19 +64,37 @@ var DialWithBackOff = NewBackoffDialer(backOffTemplate)
 // between tries.
 func NewBackoffDialer(backoffConfig wait.Backoff) func(context.Context, string, string) (net.Conn, error) {
 	return func(ctx context.Context, network, address string) (net.Conn, error) {
-		return dialBackOffHelper(ctx, network, address, backoffConfig, sleepTO)
+		return dialBackOffHelper(ctx, network, address, backoffConfig, nil)
 	}
 }
 
-func dialBackOffHelper(ctx context.Context, network, address string, bo wait.Backoff, sleep time.Duration) (net.Conn, error) {
+// DialTLSWithBackOff is same with DialWithBackOff but takes tls config.
+var DialTLSWithBackOff = NewTLSBackoffDialer(backOffTemplate)
+
+// NewTLSBackoffDialer is same with NewBackoffDialer but takes tls config.
+func NewTLSBackoffDialer(backoffConfig wait.Backoff) func(context.Context, string, string, *tls.Config) (net.Conn, error) {
+	return func(ctx context.Context, network, address string, tlsConf *tls.Config) (net.Conn, error) {
+		return dialBackOffHelper(ctx, network, address, backoffConfig, tlsConf)
+	}
+}
+
+func dialBackOffHelper(ctx context.Context, network, address string, bo wait.Backoff, tlsConf *tls.Config) (net.Conn, error) {
 	dialer := &net.Dialer{
 		Timeout:   bo.Duration, // Initial duration.
 		KeepAlive: 5 * time.Second,
 		DualStack: true,
 	}
 	start := time.Now()
 	for {
-		c, err := dialer.DialContext(ctx, network, address)
+		var (
+			c   net.Conn
+			err error
+		)
+		if tlsConf == nil {
+			c, err = dialer.DialContext(ctx, network, address)
+		} else {
+			c, err = tls.DialWithDialer(dialer, network, address, tlsConf)
+		}
 		if err != nil {
 			var errNet net.Error
 			if errors.As(err, &errNet) && errNet.Timeout() {
@@ -105,6 +124,19 @@ func newHTTPTransport(disableKeepAlives, disableCompression bool, maxIdle, maxId
 	return transport
 }
 
+func newHTTPSTransport(disableKeepAlives, disableCompression bool, maxIdle, maxIdlePerHost int, tlsConf *tls.Config) http.RoundTripper {
+	transport := http.DefaultTransport.(*http.Transport).Clone()
+	transport.DialContext = DialWithBackOff
+	transport.DisableKeepAlives = disableKeepAlives
+	transport.MaxIdleConns = maxIdle
+	transport.MaxIdleConnsPerHost = maxIdlePerHost
+	transport.ForceAttemptHTTP2 = false
+	transport.DisableCompression = disableCompression
+
+	transport.TLSClientConfig = tlsConf
+	return transport
+}
+
 // NewProberTransport creates a RoundTripper that is useful for probing,
 // since it will not cache connections.
 func NewProberTransport() http.RoundTripper {
@@ -113,6 +145,13 @@ func NewProberTransport() http.RoundTripper {
 		NewH2CTransport())
 }
 
+// NewProxyAutoTLSTransport is same with NewProxyAutoTransport but it has tls.Config to create HTTPS request.
+func NewProxyAutoTLSTransport(maxIdle, maxIdlePerHost int, tlsConf *tls.Config) http.RoundTripper {
+	return newAutoTransport(
+		newHTTPSTransport(false /*disable keep-alives*/, true /*disable auto-compression*/, maxIdle, maxIdlePerHost, tlsConf),
+		newH2Transport(true /*disable auto-compression*/, tlsConf))
+}
+
 // NewAutoTransport creates a RoundTripper that can use appropriate transport
 // based on the request's HTTP version.
 func NewAutoTransport(maxIdle, maxIdlePerHost int) http.RoundTripper {

network/transports_test.go

@@ -18,6 +18,9 @@ package network
 
 import (
 	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -26,6 +29,11 @@ import (
 	"k8s.io/apimachinery/pkg/util/sets"
 )
 
+const (
+	timeoutErr           = "timed out dialing"
+	connectionRefusedErr = "connection refused"
+)
+
 func TestHTTPRoundTripper(t *testing.T) {
 	wants := sets.NewString()
 	frt := func(key string) http.RoundTripper {
@@ -69,34 +77,66 @@ func TestHTTPRoundTripper(t *testing.T) {
 }
 
 func TestDialWithBackoff(t *testing.T) {
+	// Make the test short.
+	bo := backOffTemplate
+	bo.Steps = 2
+
 	// Nobody's listening on a random port. Usually.
-	c, err := DialWithBackOff(context.Background(), "tcp4", "127.0.0.1:41482")
-	if err == nil {
-		c.Close()
-		t.Error("Unexpected success dialing")
+	c, err := dialBackOffHelper(context.Background(), "tcp4", "127.0.0.1:41482", bo, nil)
+	verifyFailedConnection(t, c, err, connectionRefusedErr)
+
+	// Timeout. Use special testing IP address.
+	c, err = dialBackOffHelper(context.Background(), "tcp4", "198.18.0.254:8888", bo, nil)
+	verifyFailedConnection(t, c, err, timeoutErr)
+
+	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
+	defer s.Close()
+
+	c, err = DialWithBackOff(context.Background(), "tcp4", strings.TrimPrefix(s.URL, "http://"))
+	if err != nil {
+		t.Fatal("Dial error =", err)
 	}
+	c.Close()
+}
 
+func TestDialTLSWithBackoff(t *testing.T) {
 	// Make the test short.
 	bo := backOffTemplate
 	bo.Steps = 2
 
-	// Timeout. Use special testing IP address.
-	c, err = dialBackOffHelper(context.Background(), "tcp4", "198.18.0.254:8888", bo, sleepTO)
-	if err == nil {
-		c.Close()
-		t.Error("Unexpected success dialing")
-	}
-	const expectedErrPrefix = "timed out dialing"
-	if err == nil || !strings.HasPrefix(err.Error(), expectedErrPrefix) {
-		t.Errorf("Error = %v, want: %s(...)", err, expectedErrPrefix)
+	tlsConf := &tls.Config{
+		InsecureSkipVerify: false,
+		ServerName:         "example.com",
+		MinVersion:         tls.VersionTLS12,
 	}
 
-	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
+	// Nobody's listening on a random port. Usually.
+	c, err := dialBackOffHelper(context.Background(), "tcp4", "127.0.0.1:41482", bo, tlsConf)
+	verifyFailedConnection(t, c, err, connectionRefusedErr)
+
+	// Timeout. Use special testing IP address.
+	c, err = dialBackOffHelper(context.Background(), "tcp4", "198.18.0.254:8888", bo, tlsConf)
+	verifyFailedConnection(t, c, err, timeoutErr)
+
+	s := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
 	defer s.Close()
 
-	c, err = DialWithBackOff(context.Background(), "tcp4", strings.TrimPrefix(s.URL, "http://"))
+	rootCAs := x509.NewCertPool()
+	rootCAs.AddCert(s.Certificate())
+	tlsConf.RootCAs = rootCAs
+
+	c, err = DialTLSWithBackOff(context.Background(), "tcp4", strings.TrimPrefix(s.URL, "https://"), tlsConf)
 	if err != nil {
 		t.Fatal("Dial error =", err)
 	}
 	c.Close()
 }
+
+func verifyFailedConnection(t *testing.T, c net.Conn, err error, prefix string) {
+	if err == nil {
+		c.Close()
+		t.Error("Unexpected success dialing")
+	} else if !strings.Contains(err.Error(), prefix) {
+		t.Errorf("Error = %v, want: %s(...)", err, prefix)
+	}
+}